Dir 513 CVE-2026-5024

D-Link DIR-513 firmware version 1.10. Requires authenticated access to the web interface (/goform/formSetEmail endpoint). Attacker must be a logged-in user with credentials. Crafted curTime parameter triggers stack-based buffer overflow in formSetEmail function. Product is end-of-life and no longer supported.

Real-world risk is HIGH despite requiring authenticated access (PR:L). The CVSS v3.1 base score of 8.8 reflects network-accessible attack vector (AV:N), low complexity (AC:L), and complete system compromise potential (C:H/I:H/A:H). The Exploit Maturity indicator (E:P for Proof-of-Concept) combined with confirmed public exploit code on GitHub means any attacker with basic skills can weaponize this vulnerability immediately. Authentication requirement is a minor barrier since D-Link routers historically ship with default credentials (admin/blank or admin/admin), and many users never change them. The CRITICAL aggravating factor is D-Link's end-of-life status for DIR-513 (RL:X - no remediation available), meaning deployed devices will remain vulnerable indefinitely. No CISA KEV listing indicates no confirmed large-scale exploitation campaigns yet, but the combination of public POC, remote access, and permanent unfixable status makes this a high-priority risk for any organization still operating these devices. SSVC assessment: Exploitation=POC, Automatable=yes (default creds common), Technical Impact=total (complete device takeover). Decision: IMMEDIATE action required.

An attacker discovers a D-Link DIR-513 router exposed on the internet via Shodan or similar scanning, attempts common default credentials (admin/blank), successfully authenticates to the web interface, and accesses the email configuration page at /goform/formSetEmail. The attacker crafts a malicious HTTP POST request with an oversized curTime parameter containing shellcode and return address overwrites, triggering the stack-based buffer overflow when formSetEmail processes the input. Successful exploitation grants the attacker root-level code execution on the router's embedded Linux OS, allowing installation of persistent backdoors, traffic interception, DNS hijacking, or pivot attacks into the internal network. The publicly available proof-of-concept code on GitHub provides ready-made exploitation tools, reducing the required attacker skill level to script-kiddie tier.